Luxion KeyShot: RCE Vulnerability in BIP Files, Patch Available

Editor's note: This analysis is based on the ZDI-26-748 advisory from Trend Micro's Zero Day Initiative. The CVE-2026-92202 record is assigned but not yet populated by the assigning CNA. Technical details and timeline reflect exclusively the content documented by ZDI.

Luxion has released a corrective update for a remote code execution vulnerability in KeyShot's BIP file parsing, publicly disclosed on September 23, 2026, via advisory ZDI-26-748. The flaw, tracked as CVE-2026-92202 with a CVSS score of 7.8, allows the loading of libraries from an unsafe path when opening a malicious BIP file.

The Mechanism: From 3D File to Code Execution

The vulnerability resides in KeyShot's BIP file parser, a proprietary format used to store 3D rendering scenes, materials, and design assets. According to the ZDI advisory, the root cause is a flaw in loading a library from an uncontrolled search path during BIP file parsing.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file." — ZDI Advisory ZDI-26-748

The ZDI advisory specifies that code executes in the context of the current process. The payload does not travel inside the BIP file itself but exploits the parser's behavior when searching for external dependencies. The seemingly legitimate file acts as a trigger, while actual execution occurs via a library placed in an unsafe path.

This class of vulnerability, termed "Uncontrolled Search Path Element" in ZDI terminology, is particularly insidious because it does not require complex memory exploits. The parser searches for libraries in attacker-controllable directories, loading malicious code with the privileges of the running KeyShot process.

Risk Context in the Industrial Design Sector

KeyShot is deployed in environments where the supply chain exchanges design files with clients, suppliers, and external studios: automotive, consumer electronics, packaging design, commercial architecture. In these workflows, the BIP file is a frequent exchange format.

The ZDI advisory does not specify whether the vector requires exclusively local files or if a web page can trigger the load via a browser. This indeterminacy leaves the risk perimeter open for organizations that publish 3D viewers or online previews.

If a threat actor had access to the BIP file distribution chain, they could insert a malicious file into an apparently ordinary exchange flow. The ZDI advisory does not document in-the-wild exploits nor identify the researcher who discovered the flaw.

What to Do Now

Verify the installed version. Luxion has released a corrective update according to the ZDI advisory. The advisory does not indicate specific vulnerable versions nor the version that fixes the issue: it is necessary to consult the Luxion support portal to identify the patched build.

Review inbound BIP file workflows. Since exploitation requires opening a malicious file, isolate or scan inbound BIP files before opening them in primary design environments.

Assess web viewer exposure. If the organization hosts KeyShot previews or viewers accessible via browser, verify whether the client-side component performs BIP parsing and is susceptible to the same library-loading vector.

Monitor the CVE record. The CVE-2026-92202 record is assigned but not yet populated. Publication of full details by the assigning CNA may provide additional information on affected versions and specific mitigations.

The 148-Day Gap and Disclosure Limits

The timeline between vendor notification and public release — April 29, 2026, to September 23, 2026 — amounts to 148 days. This interval falls within the typical coordinated disclosure window but leaves users without public guidance during the embargo period.

The ZDI advisory does not document in-the-wild exploits. The CVE-2026-92202 record is assigned but not yet populated by the assigning CNA, leaving technical detail solely in the ZDI document.

It also remains unspecified whether the patch is delivered via automatic update or requires manual download and installation. For software deployed in enterprise environments with managed deployment, this omission complicates corrective rollout planning.

Frequently Asked Questions

Does KeyShot use only BIP files or other formats as well?
KeyShot supports multiple import formats; the ZDI advisory specifically concerns the parser for Luxion's proprietary BIP files.

Is CVSS 7.8 considered high?
Yes, per the CVSS v3.1 scale a score of 7.0-8.9 falls in the "High" category. The 7.8 value reflects significant impact on confidentiality, integrity, and availability.

Are administrative privileges required to exploit the vulnerability?
No. The ZDI advisory indicates execution in the context of the current process, which typically runs with the logged-in user's privileges.

Is the CVE record complete?
No. The CVE-2026-92202 record is assigned but not yet populated by the assigning CNA at the time of analysis.

Information has been verified against cited sources and is current as of publication.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-748/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.cve.org/CVERecord?id=CVE-2026-92202
• https://www.trendmicro.com/
• https://www.trendmicro.com/en_us/business/products/one-platform.html